47c4b36fa18d6d2d9681de874f735bbb5af673cbdb8442b7c2c24c27ac06daa5

General

Target
404.html
Size 14KB
Sample260908-vdhfaagg78
SHA256 47c4b36fa18d6d2d9681de874f735bbb5af673cbdb8442b7c2c24c27ac06daa5
MD5 3d5c64a388b93c7a812b91a3ddb71d81
SHA1 fd2f9e2b5915cfbb4c7749481f09ec8cf7a917d3
SHA512 ae8f414877d24f2e60b976274fcfcc9cd0e03a582be17f58e91020a13e404dbf9ca245ff3d6425a64e39503aa9935ab7d5e7fc6d3cf5872fb01af949cea4c00a
SSDEEP 384:GnOwr2psvY1M1Fmd6qBDTX5QJsFEFA/CLK:GnOU2ps2qFmDTJQJsFEFA/CLK
TLSH
T16062A4B3AD00DE0A8A668D28503DBC3950CDC1778238D96DF6DCCD6906C3AB54BE6EC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  404.html
- Size 14KB
- SHA256 47c4b36fa18d6d2d9681de874f735bbb5af673cbdb8442b7c2c24c27ac06daa5
- MD5 3d5c64a388b93c7a812b91a3ddb71d81
- SHA1 fd2f9e2b5915cfbb4c7749481f09ec8cf7a917d3
- SHA512 ae8f414877d24f2e60b976274fcfcc9cd0e03a582be17f58e91020a13e404dbf9ca245ff3d6425a64e39503aa9935ab7d5e7fc6d3cf5872fb01af949cea4c00a
- SSDEEP 384:GnOwr2psvY1M1Fmd6qBDTX5QJsFEFA/CLK:GnOU2ps2qFmDTJQJsFEFA/CLK
- TLSH
  T16062A4B3AD00DE0A8A668D28503DBC3950CDC1778238D96DF6DCCD6906C3AB54BE6EC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence phishing spyware stealer trojan
- Checks for common network interception software
  Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
  defense_evasion
- Downloads MZ/PE file
- A potential corporate email address has been identified in the URL
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Suspicious use of SetThreadContext
behavioral1